Redirecting Subscriber Traffic Using ISG Layer 4 Redirect

Intelligent Services Gateway (ISG) is a
software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. This module describes how to configure ISG to redirect subscriber traffic by using the ISG Layer 4 Redirect feature. The ISG Layer 4 Redirect feature enables service providers to better control the user experience by allowing subscriber TCP or UDP packets to be redirected to specified servers for appropriate handling. ISG Layer 4 redirection can be used to facilitate subscriber authentication, initial and periodic advertising captivation, redirection of application traffic, and Domain Name System (DNS) redirection.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for
Redirecting ISG Subscriber Traffic

The ISG Layer 4
Redirect feature applies only to TCP or UDP traffic.

A Layer 4 Redirect
feature and a traffic-class (TC) service containing a Layer 4 Redirect feature
cannot be applied on the same session. A Layer 4 Redirect feature can be
applied on a TC in a service, but not directly on a session.

Information About Redirecting ISG Subscriber Traffic

Overview of ISG Layer 4 Redirect

The ISG Layer 4 Redirect feature redirects specified packets to servers that handle the packets in a specified manner. For example, packets sent upstream by unauthorized users can be forwarded to a server that redirects the users to a login page. Similarly, if users try to access a service to which they have not logged in, the packets can be redirected to a server that provides a service login screen.

The Layer 4 Redirect feature supports three types of redirection, which can be applied to subscriber sessions or to flows:

Initial redirection—Specified traffic is redirected for a specific duration of the time only, starting from when the feature is applied.

Periodic redirection—Specified traffic is periodically redirected. The traffic is redirected for a specified duration of time. The redirection is then suspended for another specified duration. This cycle is repeated. During periodic redirect, all new TCP connections are redirected until the duration of the redirect is over. After that time any new incoming TCP connections will not be redirected. However, all existing TCP connections that were initiated during this redirection will still be redirected so as not to break the connections.

Permanent redirection—Specified traffic is redirected to the specified server all the time.

A redirect server can be any server that is programmed to respond to the redirected packets. If ISG is used with a web portal, unauthenticated subscribers can be sent automatically to a login page when they start a browser session. Web portal applications can also redirect to service login pages, advertising pages, and message pages.

Redirected packets are sent to an individual redirect server or redirect server group that consists of one or more servers. ISG selects one server from the group on a rotating basis to receive the redirected packets.

When traffic is redirected, ISG modifies the destination IP address and TCP port of upstream packets to reflect the destination server. For downstream packets, ISG changes the source IP address and port to the original packet’s destination.

When traffic is selected by a policy map that includes a
redirection command, packets are fed back into the policy map classification scheme for a second service selection. The modified IP headers can be subject to different classification criteria. For example, if two class maps exist, each with different
redirection commands, packets could be redirected, selected by the first class map, and redirected a second time. To avoid this situation, configure traffic class maps so that two consecutive redirections cannot be applied to the same packet.

Layer 4 Redirect Applications

The Layer 4 Redirect feature supports the following applications:

TCP redirection for unauthenticated users and unauthorized services—HTTP traffic from subscribers can be redirected to a web dashboard where the subscribers can log in so that authentication and authorization can be performed.

Initial and periodic redirection for advertising captivation—Subscriber traffic can be redirected to a sponsor’s web page for a brief period of time at the start of the session or periodically throughout the session.

Redirection of application traffic—Application traffic from a subscriber can be redirected so as to provide value-added services. For example, a subscriber’s Simple Mail Transfer Protocol (SMTP) traffic can be redirected to a local mail server that can function as a forwarding agent for the mail.

DNS redirection—DNS queries may be redirected to a local DNS server. In some deployments, such as public wireless LAN (PWLAN) hot spots, subscribers may have a static DNS server addresses, which may not be reachable at certain locations. Redirecting DNS queries to a local DNS server allows applications to work properly without requiring reconfiguration.

HA Support for Layer 4 Redirect

The SSO and In ISSU feature provides high availability (HA) support for the ISG Layer 4 Redirect feature. Layer 4 redirect includes the selected service group in its checkpointed data during the initial session and bulk synchronization. The standby processor uses the service group instead of selecting a new one.

Because Layer 4 redirect translations are maintained on the forwarding processor, the translation entries and associated timers are preserved after a route processor stateful switchover (SSO) or In Service Software Upgrade (ISSU) event. The entries are re-created, however, on the new active processor after a forwarding processor switchover.

How to Configure ISG Layer 4 Redirect

There are three ways to apply Layer 4 redirection to sessions. One way is to configure redirection directly on a physical main interface or logical subinterface. A second way is to configure a service profile or service policy map with the Layer 4 redirect attribute in it, and apply that service to the session. A third way is to configure the Layer 4 redirect attribute in the user profile.

The following tasks describe how to configure Layer 4 redirection. The first task is optional. One or more of the next three tasks is required. The last task is optional.

Defining a Redirect Server Group

Perform this task to define a group of one or more servers to which traffic will be redirected. Traffic will be forwarded to servers on a rotating basis.

SUMMARY STEPS

1.enable

2.configureterminal

3.redirectserver-groupgroup-name

4.serveripip-addressportport-number

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Router> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configureterminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3

redirectserver-groupgroup-name

Example:

Router(config)# redirect server-group ADVT-SERVER

Enters redirect server-group configuration mode to define a group of servers in a named redirection server group.

Step 4

serveripip-addressportport-number

Example:

Router(config-sg-l4redirect-group)# server ip 10.0.0.1 port 8080

Adds a server to a redirect server group.

You can enter this command more than one time to add multiple servers to the server group.

Configuring Layer 4 Redirection in a Service Policy Map

Perform this task to configure Layer 4 redirection in a service policy map.

Before You Begin

The ISG Layer 4 Redirect feature is configured under a traffic class within a service policy map. This task assumes that you have defined the traffic class map. See the "Configuring ISG Subscriber Services" module for more information.

Note

Only ISG policing and accounting features can be enabled in conjunction with redirection on the same service policy.

What to Do Next

You may want to configure a method of activating the service policy map; for example, control policies can be used to activate services. For more information about methods of service activation, see the module "Configuring ISG Subscriber Services".

Configuring Layer 4
Redirection in a Service Profile or User Profile on the AAA Server

The Layer 4
Redirect feature can be configured as a Cisco vendor-specific attribute (VSA)
in a service profile on an authentication, authorization, and accounting (AAA)
server. This attribute can appear more than once in a profile to define
different types of redirections for a session and can be used in both user and
non-TC service profiles simultaneously.

SUMMARY STEPS

1. Add the Layer
4 Redirect VSA to the user profile or subscriber profile on the AAA server.

DETAILED STEPS

Command or Action

Purpose

Step 1

Add the Layer
4 Redirect VSA to the user profile or subscriber profile on the AAA server.

What to Do Next

If you configure ISG Layer 4 redirection in a service profile, you may want to configure a method of activating the service profile; for example, control policies can be used to activate services. For more information about methods of service activation, see the "Configuring ISG Subscriber Services" module.

Verifying ISG Traffic Redirection

Perform this task to verify the configuration and operation of ISG Layer 4 traffic redirection. The
show commands can be used in any order.

Example: Redirecting Unauthenticated Subscriber Traffic

In the following example, Layer 4 redirection is configured in the service policy map “BLIND-RDT.” This policy is applied to all sessions at session start and redirects subscriber TCP traffic to the server group called “PORTAL.” At account login the subscriber is authenticated and the redirection is not applied.

Example: Redirecting Unauthorized Subscriber Traffic

The following example shows the configuration of redirection for unauthorized subscribers. If the subscriber is not logged into the service called “svc,” traffic that matches “svc” is redirected to the server group “PORTAL.” Once the subscriber logs on to the service, the traffic is no longer redirected. When the subscriber logs off the service, redirection is applied again.

Example: Initial ISG Redirection

The following example shows ISG configured to redirect the Layer 4 traffic of all subscribers to a server group called “ADVT” for the initial 60 seconds of the session. After the initial 60 seconds, ISG will stop redirecting the traffic for the rest of the lifetime of the session.

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Feature Information for Redirecting ISG Subscriber Traffic

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Table 1 Feature Information for Redirecting ISG Subscriber Traffic

Feature Name

Releases

Feature Information

ISG: Flow Control: Flow Redirect

Cisco IOS XE Release 2.2

The ISG Layer 4 Redirect feature enables service providers to better control the user experience by allowing subscriber TCP or UDP packets to be redirected to specified servers for appropriate handling. ISG Layer 4 redirection can be applied to individual subscriber sessions or flows.

Parameterization for ACL and Layer 4 Redirect

Cisco IOS XE Release 2.4

The Parameterization for ACL and Layer 4 Redirect feature provides parameterization enhancements for access control lists and Layer 4 redirect.

ISG: IPv6 Support phase II

Cisco IOS XE Release 3.5S

IPv6 support was added for the Layer 4 Redirect feature.

The following commands were introduced or modified:
redirect session-limit,
redirect to,
server ip,
show redirect group,
show redirect translations.

ISG: Flow Control: SSO/ISSU

Cisco IOS XE Release 3.5S

HA support was added for ISG features including the Layer 4 Redirect feature.